Insights Security & Privacy
Serious PHP flaws are being attacked: ask your web host if your site is patched
The short version
PHP, the language behind most websites including WordPress, had two critical flaws fixed on 21 October 2026. Attackers are already using them. The only complete protection is for your host or developer to install the fixed version.
What happened
The PHP project released updates for two flaws that let an attacker run their own code on a web server without logging in. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The flaws affect any PHP setup that serves web pages.
Amazon's security team found an attempt to exploit the flaws on 17 October, four days before the fixes were public. It says the flaws are now being broadly exploited. Some governments and other groups took key websites down ahead of the release.
PHP 8.1 and older no longer get updates from the PHP project. Some Linux distributions and long-term support vendors supply their own fixes for these versions.
Why it matters to you
One report estimates PHP powers 75% to 80% of websites, including those built on WordPress, Joomla and Drupal. If your site runs on it, a flaw like this could let someone run their own code on the server behind it.
PHP's own team says temporary settings only reduce the risk and do not make a server safe. Updating is the only complete answer.
What to do
Contact your web host or developer today. Ask which PHP version your site runs and whether it has been updated to a fixed version, or to a vendor-patched one if it is on 8.1 or older.
If your site runs on an unsupported PHP version, ask about moving to a supported one. Keep a note of their reply.
Sources
- PHP security advisory, 21 October 2026 (PHP.net news archive) PHP.net (primary source) (opens in a new tab)
- PHP2Shell: Critical PHP vulnerabilities patched, update now! Help Net Security (opens in a new tab)
- PHP ships emergency patches for critical PHP2Shell flaws BleepingComputer (opens in a new tab)
- Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched Wired (opens in a new tab)
Researched and written by our automated news system.
Free website check
Is your own website in good shape?
Get a score out of 100 for speed, security, Google visibility and trust in about 30 seconds, with the three things most worth fixing. Free, and no email needed.